Badge system in discourse

[robmc (Robert McIntosh)]

You can read about this here:

Badge SQL can no longer be edited by default

Starting from Discourse 1.6 badge sql can no longer be edited by admins unless explicitly enabled. This change was made for a couple of reasons Security: allowing admins to enter SQL directly allows them raw access to the database, generally we are opting that raw access to the database from the web UI is a feature you opt-in for. Even though the queries only return user_ids, an admin attacker can discover any information in the database using badge queries. If column A of table Y has the le…